1. Field of Invention
This invention relates to computer systems security, specifically to authenticating an authorized user to a computer system.
2. Prior Art
Many computer systems are made available to a global user base through the use of the Internet. Commonly, users interact with these systems through a World Wide Web browser. Although encryption techniques such as SSL prevent eavesdropping while data travels across the Internet, some users have insecure and compromised computers.
In particular, some of these compromised computers are infected with malware that, unknown to the user, collects the user's login credentials when entered by the user during the login process for authentication to access-controlled computer systems. The malware then surreptitiously transmits the credentials to a malicious third party. This third party can then use these stolen credentials to impersonate the true user, and so perform whatever action the true user is authorized to perform.
One type of malware that does this is key-logging software. In this case, keystrokes the user enters through the keyboard, such as identifiers and passwords, are recorded by the software and then transmitted to the malicious third party. Hardware key-loggers also exist.
When key-logging became a concern, providers of systems for which security is important began to require an additional element in the login process, typically added after the point where the user has entered their user identifier and password and so established provisional authentication. Commonly, this involves the user operating a mouse to point to and click on elements on the display, for example using a virtual keypad to enter a PIN number, or selecting an answer to a question. This credential is not entered through the keyboard, and so is safe from key-logging. However, a new type of malware has been observed which, when the user clicks the mouse, copies the image from the area of the display near the pointer, and then transmits this image to the malicious third party. By selecting only a portion of the display and selecting only at the time the user clicks, this click-activated screen-scraping malware can operate with minimal resources and so avoid detection by the user.
Cryptographic hardware-based systems are available that generate one-time-use codes for second factor authentication purposes, or that incorporate a private key and use public key infrastructure as a means for authentication. However, expense and other shortcomings have precluded widespread adoption. Attempts have been made to emulate the “second factor” provided by these hardware based systems that offer proof of “something you have” by using printed articles where the user must correctly respond to a challenge by determining the correct response using the printed article, typically by looking up a response in a grid. However, while the cost of a printed article may be less than that of a device such as a smart card, the other problems associated with creating, distributing, and carrying a physical article remain and have prevented widespread adoption. These problems include loss, destruction, misplacement, theft and copying.
Onlookers, key-loggers and click-activated screen-scraping malware are still compromising the login credentials of computer users, and in this context the advantages of some embodiments of my invention become clear.